More open-ended interpretability tools have been used to design copy/paste adversarial examples including feature-visualization [1]} and methods based on network dissection [2]}, [3]}, [4]}.
Most similar to this work is [5]} who introduce robust feature level adversarial patches and use them for interpreting DNNs and designing copy-paste attacks.
However, copy/paste attacks from [1]}, [3]}, [4]}, [5]} have been limited to simple proofs of concept with manually-designed attacks.
We build off of these with SNAFUE, offering the first method to date that can identify natural combinations of adversarial features for vision models in a way that (1) is not restricted to a fixed set of transformations or a limited set of source and target classes and (2) efficiently automatable.
